CVE-2018-1048: Improper Limitation of a Pathname to a Restricted Directory in Jboss EAP Undertow
Summary
CVE-2018-1048: Improper Limitation of a Pathname to a Restricted Directory in Jboss EAP Undertow. Affects org.jboss.eap:wildfly-undertow versions >= 7.1.0.GA, < 7.1.1.GA. Fixed in 7.1.1.GA. How to fix ↓
Also tracked for
- undertow · Debian:13
The same CVE-2018-1048 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jboss EAP Undertow is a web server component that is part of the Jboss Enterprise Application Platform (EAP). It provides support for handling HTTP requests and serving web applications. The AJP connector in Undertow allows communication between the web server and a backend server using the AJP protocol. This vulnerability affects Jboss EAP version 7.1.0.GA and allows for path traversal and information disclosure of arbitrary local files.
Vulnerability Detail
The AJP connector in Jboss EAP Undertow does not properly handle encoded slash and anti-slash characters in the URL, which can be exploited to perform path traversal attacks. An attacker can craft a specially crafted URL that includes encoded slashes or anti-slashes to bypass directory restrictions and access arbitrary files on the server. This can lead to the disclosure of sensitive information stored on the server.
How To Fix
Minimum fixed version
7.1.1.GA
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a workaround is to disable the AJP connector in Undertow. This can be done by modifying the server configuration to remove or comment out the AJP connector configuration. However, this may impact the functionality of applications that rely on the AJP connector for communication with backend servers.
Conclusion
The vulnerability in Jboss EAP Undertow allows for path traversal and information disclosure of arbitrary local files. It is recommended to upgrade to the latest version of Jboss EAP to fix this vulnerability. If immediate upgrade is not possible, disabling the AJP connector in Undertow can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jboss.eap:wildfly-undertow →
FAQ
This vulnerability allows an attacker to access arbitrary files on the server, potentially leading to the disclosure of sensitive information.
There is no known public exploit for this vulnerability at the time of writing.
No, only Jboss EAP version 7.1.0.GA is affected. Later versions include a fix for this vulnerability.
Yes, this vulnerability can be exploited remotely by sending a specially crafted URL to the affected server.
Yes, the CVSS score for this vulnerability is 7.5 (High).
Related vulnerabilities
Recent vulnerabilities recorded for org.jboss.eap:wildfly-undertow.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.